1. Web Application Security
A Concrete Discussion
with Brad

2. Common Web App Security Issues
XSS
SQLi
Code Injection
Command Injection
File Uploads
Data Extraction

3. Some Examples Follow The people are real The vulnerabilities are real
The findings are final

4. Brad Was Here... Again

5. The Randy Award

6. Randy Squared

7. Randy Randy Randy

8. Manual Process
Expensive
Slow
Knowledge
Time
Motivation

9. Dorkbot Automation All notifications will come from
All checks will come from
autoscan.infosec.utexas.edu ( )
You might see some manual verification from
/24

10. Dorkbot Report

11. Closing Remarks University Policy 7010
‘Maintain the operating system and application software with appropriate updates’
Appropriate updates means patches and updates that correct vulnerable code.
Standard for Securing Web Technology Resources
Input validation is to developers what weak passwords are to users.